Skip to main content

Quarterly Patch Planning

Use this playbook to plan a quarterly patch cycle using Cloudaware Vulnerability Management together with Patch Management.

Review Current Risk Posture​

  1. Open vulnerability dashboards filtered to:
    • Production environments.
    • Critical and High risk bands.
  2. Identify:
    • Top OUs and applications by outstanding vulnerabilities.
    • Common CVEs or packages across many systems.

Define Scope and Objectives​

  1. Decide which:
    • Environments (prod, non‑prod).
    • Asset classes (servers, containers, databases).
    • Risk bands (Critical/High, possibly Medium) will be in scope.
  2. Set measurable goals (e.g., “Reduce High vulnerabilities in prod by 50%”).

Align with Patch Management​

  1. With Patch Management owners, map vulnerabilities to:
    • Patch baselines and snapshots.
    • Maintenance windows and blackout periods.
  2. Create or update patch waves aligned with:
    • Application dependencies.
    • Change Management constraints.

See Patch Management for details.

Create Initiatives and Tasks​

  1. Create a quarterly Initiative that:
    • Defines objectives, scope, and timelines.
    • Aggregates related Remediation Tasks.
  2. Generate Remediation Tasks:
    • By OU or application.
    • By technology/platform (e.g., Windows servers, Kubernetes nodes).
    • With due dates linked to quarterly milestones.

For more details on remediation initiatives and tasks, see Vulnerability Management Processes.

Ensure tickets are created in ITSM for each task as required.

Track Progress​

  1. Use dashboards to monitor:
    • Open vs remediated vulnerabilities within the Initiative scope.
    • SLA compliance and overdue tasks.
    • Completion of patch waves.
  2. Run scheduled reports to OU and application owners throughout the quarter.

Close and Retrospective​

  1. When objectives are met:
    • Verify via scans that targeted vulnerabilities are remediated.
    • Close remaining tasks or re‑scope them into the next cycle.
  2. Capture lessons learned:
    • Where patch windows were too narrow.
    • Where ownership or routing slowed progress.

Feed improvements back into risk models, SLAs, and operational practices.